CVE-2025-47682: Cozyvision SMS Alert SQLi Vulnerability

CVE-2025-47682 Overview

CVE-2025-47682 is a SQL injection vulnerability in the Cozy Vision SMS Alert Order Notifications plugin for WordPress and WooCommerce. The plugin fails to properly neutralize special elements in SQL commands, allowing attackers to inject arbitrary SQL statements. The flaw affects all versions up to and including 3.8.1. Exploitation requires no authentication and can be performed remotely over the network. Successful attacks compromise database confidentiality, integrity, and availability on affected WordPress sites.

Critical Impact
Unauthenticated remote attackers can execute arbitrary SQL queries against the WordPress database, enabling data theft, administrative account creation, and full site takeover.

Affected Products

Cozy Vision SMS Alert Order Notifications plugin for WordPress (free edition)
All versions from initial release through 3.8.1
WooCommerce installations using the affected plugin

Discovery Timeline

2025-05-12 - CVE-2025-47682 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-47682

Vulnerability Analysis

The vulnerability is classified as [CWE-89] Improper Neutralization of Special Elements used in an SQL Command. The plugin accepts user-controlled input and incorporates it directly into SQL queries without parameterization or proper sanitization. Attackers can craft malicious request parameters that break out of the intended query context and append arbitrary SQL clauses.

The attack requires no privileges and no user interaction. An attacker only needs network access to a WordPress site running the vulnerable plugin. Because WordPress database users typically hold broad privileges on the site database, a successful injection grants the attacker the ability to read sensitive tables such as wp_users, modify content, or insert administrative accounts.

Root Cause

The root cause is the absence of prepared statements or $wpdb->prepare() usage when constructing SQL queries from request data. WordPress provides parameterized query APIs, but the plugin bypasses these safeguards and concatenates raw input into query strings. Versions through 3.8.1 contain this flaw across one or more plugin endpoints handling SMS alert and order notification operations.

Attack Vector

Exploitation occurs over HTTP or HTTPS by sending crafted requests to plugin endpoints exposed by the WordPress site. The attacker injects SQL syntax such as UNION SELECT statements or boolean-based payloads through vulnerable parameters. Time-based blind SQL injection techniques may also be viable depending on the endpoint behavior. See the Patchstack SMS Alert Vulnerability advisory for additional technical context.

Detection Methods for CVE-2025-47682

Indicators of Compromise

Unexpected HTTP requests to SMS Alert plugin endpoints containing SQL keywords such as UNION, SELECT, SLEEP, or BENCHMARK
New or unrecognized administrator accounts created in the wp_users table
Anomalous database query patterns or slow query log entries originating from plugin code paths
Outbound connections from the web server to attacker-controlled hosts following suspicious requests

Detection Strategies

Inspect web server access logs for requests containing URL-encoded SQL metacharacters such as %27, %22, or -- targeting plugin URLs
Enable MySQL general query logging temporarily to identify malformed or suspicious queries originating from the plugin
Deploy a web application firewall (WAF) with rules matching common SQL injection signatures

Monitoring Recommendations

Monitor for changes to WordPress administrative accounts and role assignments
Alert on unexpected modifications to plugin and theme files on the web server filesystem
Track outbound network connections from the WordPress server to non-corporate destinations

How to Mitigate CVE-2025-47682

Immediate Actions Required

Identify all WordPress installations running the SMS Alert Order Notifications plugin version 3.8.1 or earlier
Deactivate and remove the plugin until a patched version is confirmed available from the vendor
Review the wp_users and wp_usermeta tables for unauthorized administrator accounts
Rotate WordPress administrator credentials and database passwords if compromise is suspected

Patch Information

No fixed version is identified in the available advisory data. The vulnerability affects all releases through 3.8.1. Monitor the Patchstack advisory and the WordPress plugin repository for an updated release addressing CVE-2025-47682.

Workarounds

Remove the plugin entirely if SMS alert functionality is non-essential to business operations
Restrict access to WordPress admin and plugin endpoints using IP allow-listing at the web server or WAF layer
Deploy virtual patching rules through a WAF to block SQL injection payloads targeting plugin parameters
Apply least-privilege database permissions to the WordPress database user where feasible

bash

# Example WAF rule to block common SQL injection patterns targeting the plugin
SecRule REQUEST_URI "@contains /wp-content/plugins/sms-alert/" \
    "id:1004782,phase:2,deny,status:403,\
     chain,msg:'Possible SQLi against SMS Alert plugin (CVE-2025-47682)'"
    SecRule ARGS "@rx (?i)(union(\s|\+)+select|sleep\s*\(|benchmark\s*\(|--|';)"